The disclosure herein pertains generally to the field of computer networks. An operator of a telecommunication network can find it beneficial to analyze the traffic that flows through that network. Such analysis might be performed for a variety of different reasons. For example, the operator might want to obtain information that could be used as business intelligence. For another example, the operator might want to detect and pre-empt attacks being made through the network. In order to help prevent such attacks, the operator might want to analyze traffic to determine the sources from which different types of traffic originate.
Such traffic analysis can be performed at an analytic server that the operator maintains. Data packets flowing through the network can intercepted at network elements situated within the network between the data sources and the data destinations. These network elements can duplicate the data packets prior to forwarding those data packets on toward their ultimate destinations. The network elements can divert the duplicate packets to an analytic server. Due to the vast amount of traffic that flows through the network, the operator might maintain numerous separate analytic servers that are capable of analyzing different portions of the total traffic concurrently. The process of intercepting data packets, duplicating them, and forwarding the duplicates to analytic servers is called “telemetry.”
FIG. 1 is a block diagram that illustrates an example 100 of an L2/L3 switch that can receive data packets from various sources, duplicate those data packets, and forward the duplicates to various separate analytic servers. Data sources 102A-N can be communicatively coupled to Internet 104. Data sources 102A-N can address data packets to various specified destinations, typically identified by destination Internet Protocol (IP) addresses. Data sources 102A-N can then send these data packets through Internet 104. Network elements within Internet 104 can forward the data packets hop by hop toward their ultimate destinations.
An L2/L3 switch 108 can be communicatively coupled to (and potentially within) Internet 104. L2/L3 switch 108 can expose a set of ingress ports 106A-N and a set of egress ports 110A-N. Ingress ports 106A-N can communicatively couple L2/L3 switch 108 to various separate network elements within Internet 104. Ingress ports 106A-N can receive data packets that are travelling through Internet 104 on their way to their specified destinations. L2/L3 switch 108 can create duplicates of these arriving data packets.
For each original arriving data packet, L2/L3 switch 108 can look up a next hop for that data packet based on its specified destination. L2/L3 switch 108 can forward each original data packet on toward its next hop through one of the switch's egress ports (not necessarily any of egress ports 110A-N) that is connected to that next hop. In this manner, the original data packets eventually reach their specified destinations.
At least some of egress ports 110A-N can be communicatively coupled to separate analytic servers 112A-N. L2/L3 switch 108 can select one or more of analytic servers 112A-N to be responsible for analyzing the network traffic to which the duplicate data packet belongs. L2/L3 switch 108 can then forward the duplicate data packet out of one of egress ports 110A-N that is communicatively coupled to the one of analytic servers 112A-N that is responsible for analyzing that class of traffic.
Analytic servers 112A-N can receive duplicate data packets from L2/L3 switch 108. Analytic servers 112A-N can perform analysis relative to those packets. Analytic servers 112A-N can generate statistics and reports based on the analysis that they perform.